CVE-2026-45733 in Trilium Notes
Summary
by MITRE • 08/18/2026
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
Trilium Notes is a cross-platform hierarchical note-taking application designed for building large personal knowledge bases. A critical security vulnerability was identified within versions prior to 0.103.0, specifically affecting the client-side rendering logic used in quick search and note autocomplete features. The flaw resides in how the application handles user-supplied input when generating UI elements. Specifically, the getNoteIcon() function returns a label value designated as #iconClass without applying necessary HTML attribute encoding. This raw value is then directly inserted into class attributes within the JavaScript files responsible for quick_search.ts and note_autocomplete.ts functionality.
This lack of proper sanitization creates a Stored Cross-Site Scripting (XSS) vulnerability, categorized under CWE-79 in industry standards. Because the input is stored on the server or local database before being rendered to other users or even the same user upon subsequent interactions, an attacker can inject malicious JavaScript payloads into note titles or icon classes. When another victim opens a new tab within Trilium Notes or utilizes the Ctrl+J shortcut to trigger the quick search interface, the application renders the stored payload automatically without requiring further interaction from the victim beyond viewing the affected element.
The severity of this vulnerability is significantly amplified by the underlying architecture of the Electron framework used to build Trilium Notes. By default in many configurations, and specifically as exploited here, Node.js integration is enabled within the renderer process, and context isolation is disabled. This configuration allows JavaScript code executed in the browser-like environment to have direct access to Node.js APIs. Consequently, the stored XSS payload does not merely execute client-side scripts for cosmetic changes or data theft; it can invoke operating system commands with the privileges of the user running the application.
This capability transforms a standard web vulnerability into a Remote Code Execution (RCE) scenario, aligning with MITRE ATT&CK technique T1059 Command and Scripting Interpreter. An attacker who successfully injects such a payload gains the ability to execute arbitrary commands on the victim's host machine. This could lead to full system compromise, including data exfiltration, installation of malware, or lateral movement within a network if the compromised user has access to shared resources. The impact is particularly severe because it bypasses traditional web security boundaries by leveraging the desktop application environment.
The vulnerability was addressed in version 0.103.0 through rigorous input validation and output encoding practices. Developers ensured that all dynamic values inserted into HTML attributes are properly escaped, preventing the browser from interpreting malicious scripts as executable code. To mitigate this risk for users still on older versions, immediate upgrading to version 0.103.0 or later is strongly recommended. Additionally, organizations deploying Trilium Notes should review their Electron configurations to ensure that contextIsolation and nodeIntegration settings align with security best practices, such as disabling nodeIntegration in renderer processes where possible, thereby reducing the attack surface even if similar vulnerabilities are discovered in future updates.